sbin/pfctl/pf_print_state.c

   1 /*      $OpenBSD: pf_print_state.c,v 1.52 2008/08/12 16:40:18 david Exp $       */
   2
   3 /*-
   4  * SPDX-License-Identifier: BSD-2-Clause
   5  *
   6  * Copyright (c) 2001 Daniel Hartmeier
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  *
  13  *    - Redistributions of source code must retain the above copyright
  14  *      notice, this list of conditions and the following disclaimer.
  15  *    - Redistributions in binary form must reproduce the above
  16  *      copyright notice, this list of conditions and the following
  17  *      disclaimer in the documentation and/or other materials provided
  18  *      with the distribution.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  24  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  28  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  30  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  31  * POSSIBILITY OF SUCH DAMAGE.
  32  *
  33  */
  34
  35 #include <sys/cdefs.h>
  36 __FBSDID("$FreeBSD$");
  37
  38 #include <sys/types.h>
  39 #include <sys/socket.h>
  40 #include <sys/endian.h>
  41 #include <net/if.h>
  42 #define TCPSTATES
  43 #include <netinet/tcp_fsm.h>
  44 #include <net/pfvar.h>
  45 #include <arpa/inet.h>
  46 #include <netdb.h>
  47
  48 #include <stdint.h>
  49 #include <stdio.h>
  50 #include <string.h>
  51
  52 #include "pfctl_parser.h"
  53 #include "pfctl.h"
  54
  55 void    print_name(struct pf_addr *, sa_family_t);
  56
  57 void
  58 print_addr(struct pf_addr_wrap *addr, sa_family_t af, int verbose)
  59 {
  60         switch (addr->type) {
  61         case PF_ADDR_DYNIFTL:
  62                 printf("(%s", addr->v.ifname);
  63                 if (addr->iflags & PFI_AFLAG_NETWORK)
  64                         printf(":network");
  65                 if (addr->iflags & PFI_AFLAG_BROADCAST)
  66                         printf(":broadcast");
  67                 if (addr->iflags & PFI_AFLAG_PEER)
  68                         printf(":peer");
  69                 if (addr->iflags & PFI_AFLAG_NOALIAS)
  70                         printf(":0");
  71                 if (verbose) {
  72                         if (addr->p.dyncnt <= 0)
  73                                 printf(":*");
  74                         else
  75                                 printf(":%d", addr->p.dyncnt);
  76                 }
  77                 printf(")");
  78                 break;
  79         case PF_ADDR_TABLE:
  80                 if (verbose)
  81                         if (addr->p.tblcnt == -1)
  82                                 printf("<%s:*>", addr->v.tblname);
  83                         else
  84                                 printf("<%s:%d>", addr->v.tblname,
  85                                     addr->p.tblcnt);
  86                 else
  87                         printf("<%s>", addr->v.tblname);
  88                 return;
  89         case PF_ADDR_RANGE: {
  90                 char buf[48];
  91
  92                 if (inet_ntop(af, &addr->v.a.addr, buf, sizeof(buf)) == NULL)
  93                         printf("?");
  94                 else
  95                         printf("%s", buf);
  96                 if (inet_ntop(af, &addr->v.a.mask, buf, sizeof(buf)) == NULL)
  97                         printf(" - ?");
  98                 else
  99                         printf(" - %s", buf);
 100                 break;
 101         }
 102         case PF_ADDR_ADDRMASK:
 103                 if (PF_AZERO(&addr->v.a.addr, AF_INET6) &&
 104                     PF_AZERO(&addr->v.a.mask, AF_INET6))
 105                         printf("any");
 106                 else {
 107                         char buf[48];
 108
 109                         if (inet_ntop(af, &addr->v.a.addr, buf,
 110                             sizeof(buf)) == NULL)
 111                                 printf("?");
 112                         else
 113                                 printf("%s", buf);
 114                 }
 115                 break;
 116         case PF_ADDR_NOROUTE:
 117                 printf("no-route");
 118                 return;
 119         case PF_ADDR_URPFFAILED:
 120                 printf("urpf-failed");
 121                 return;
 122         default:
 123                 printf("?");
 124                 return;
 125         }
 126
 127         /* mask if not _both_ address and mask are zero */
 128         if (addr->type != PF_ADDR_RANGE &&
 129             !(PF_AZERO(&addr->v.a.addr, AF_INET6) &&
 130             PF_AZERO(&addr->v.a.mask, AF_INET6))) {
 131                 int bits = unmask(&addr->v.a.mask, af);
 132
 133                 if (bits != (af == AF_INET ? 32 : 128))
 134                         printf("/%d", bits);
 135         }
 136 }
 137
 138 void
 139 print_name(struct pf_addr *addr, sa_family_t af)
 140 {
 141         char host[NI_MAXHOST];
 142
 143         strlcpy(host, "?", sizeof(host));
 144         switch (af) {
 145         case AF_INET: {
 146                 struct sockaddr_in sin;
 147
 148                 memset(&sin, 0, sizeof(sin));
 149                 sin.sin_len = sizeof(sin);
 150                 sin.sin_family = AF_INET;
 151                 sin.sin_addr = addr->v4;
 152                 getnameinfo((struct sockaddr *)&sin, sin.sin_len,
 153                     host, sizeof(host), NULL, 0, NI_NOFQDN);
 154                 break;
 155         }
 156         case AF_INET6: {
 157                 struct sockaddr_in6 sin6;
 158
 159                 memset(&sin6, 0, sizeof(sin6));
 160                 sin6.sin6_len = sizeof(sin6);
 161                 sin6.sin6_family = AF_INET6;
 162                 sin6.sin6_addr = addr->v6;
 163                 getnameinfo((struct sockaddr *)&sin6, sin6.sin6_len,
 164                     host, sizeof(host), NULL, 0, NI_NOFQDN);
 165                 break;
 166         }
 167         }
 168         printf("%s", host);
 169 }
 170
 171 void
 172 print_host(struct pf_addr *addr, u_int16_t port, sa_family_t af, int opts)
 173 {
 174         if (opts & PF_OPT_USEDNS)
 175                 print_name(addr, af);
 176         else {
 177                 struct pf_addr_wrap aw;
 178
 179                 memset(&aw, 0, sizeof(aw));
 180                 aw.v.a.addr = *addr;
 181                 if (af == AF_INET)
 182                         aw.v.a.mask.addr32[0] = 0xffffffff;
 183                 else {
 184                         memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask));
 185                         af = AF_INET6;
 186                 }
 187                 print_addr(&aw, af, opts & PF_OPT_VERBOSE2);
 188         }
 189
 190         if (port) {
 191                 if (af == AF_INET)
 192                         printf(":%u", ntohs(port));
 193                 else
 194                         printf("[%u]", ntohs(port));
 195         }
 196 }
 197
 198 void
 199 print_seq(struct pfctl_state_peer *p)
 200 {
 201         if (p->seqdiff)
 202                 printf("[%u + %u](+%u)", p->seqlo,
 203                     p->seqhi - p->seqlo, p->seqdiff);
 204         else
 205                 printf("[%u + %u]", p->seqlo,
 206                     p->seqhi - p->seqlo);
 207 }
 208
 209 void
 210 print_state(struct pfctl_state *s, int opts)
 211 {
 212         struct pfctl_state_peer *src, *dst;
 213         struct pfctl_state_key *key, *sk, *nk;
 214         const char *protoname;
 215         int min, sec;
 216         sa_family_t af;
 217         uint8_t proto;
 218 #ifndef __NO_STRICT_ALIGNMENT
 219         struct pfctl_state_key aligned_key[2];
 220
 221         bcopy(&s->key, aligned_key, sizeof(aligned_key));
 222         key = aligned_key;
 223 #else
 224         key = s->key;
 225 #endif
 226
 227         af = s->key[PF_SK_WIRE].af;
 228         proto = s->key[PF_SK_WIRE].proto;
 229
 230         if (s->direction == PF_OUT) {
 231                 src = &s->src;
 232                 dst = &s->dst;
 233                 sk = &key[PF_SK_STACK];
 234                 nk = &key[PF_SK_WIRE];
 235                 if (proto == IPPROTO_ICMP || proto == IPPROTO_ICMPV6)
 236                         sk->port[0] = nk->port[0];
 237         } else {
 238                 src = &s->dst;
 239                 dst = &s->src;
 240                 sk = &key[PF_SK_WIRE];
 241                 nk = &key[PF_SK_STACK];
 242                 if (proto == IPPROTO_ICMP || proto == IPPROTO_ICMPV6)
 243                         sk->port[1] = nk->port[1];
 244         }
 245         printf("%s ", s->ifname);
 246         if ((protoname = pfctl_proto2name(proto)) != NULL)
 247                 printf("%s ", protoname);
 248         else
 249                 printf("%u ", proto);
 250
 251         print_host(&nk->addr[1], nk->port[1], af, opts);
 252         if (PF_ANEQ(&nk->addr[1], &sk->addr[1], af) ||
 253             nk->port[1] != sk->port[1]) {
 254                 printf(" (");
 255                 print_host(&sk->addr[1], sk->port[1], af, opts);
 256                 printf(")");
 257         }
 258         if (s->direction == PF_OUT)
 259                 printf(" -> ");
 260         else
 261                 printf(" <- ");
 262         print_host(&nk->addr[0], nk->port[0], af, opts);
 263         if (PF_ANEQ(&nk->addr[0], &sk->addr[0], af) ||
 264             nk->port[0] != sk->port[0]) {
 265                 printf(" (");
 266                 print_host(&sk->addr[0], sk->port[0], af, opts);
 267                 printf(")");
 268         }
 269
 270         printf("    ");
 271         if (proto == IPPROTO_TCP) {
 272                 if (src->state <= TCPS_TIME_WAIT &&
 273                     dst->state <= TCPS_TIME_WAIT)
 274                         printf("   %s:%s\n", tcpstates[src->state],
 275                             tcpstates[dst->state]);
 276                 else if (src->state == PF_TCPS_PROXY_SRC ||
 277                     dst->state == PF_TCPS_PROXY_SRC)
 278                         printf("   PROXY:SRC\n");
 279                 else if (src->state == PF_TCPS_PROXY_DST ||
 280                     dst->state == PF_TCPS_PROXY_DST)
 281                         printf("   PROXY:DST\n");
 282                 else
 283                         printf("   <BAD STATE LEVELS %u:%u>\n",
 284                             src->state, dst->state);
 285                 if (opts & PF_OPT_VERBOSE) {
 286                         printf("   ");
 287                         print_seq(src);
 288                         if (src->wscale && dst->wscale)
 289                                 printf(" wscale %u",
 290                                     src->wscale & PF_WSCALE_MASK);
 291                         printf("  ");
 292                         print_seq(dst);
 293                         if (src->wscale && dst->wscale)
 294                                 printf(" wscale %u",
 295                                     dst->wscale & PF_WSCALE_MASK);
 296                         printf("\n");
 297                 }
 298         } else if (proto == IPPROTO_UDP && src->state < PFUDPS_NSTATES &&
 299             dst->state < PFUDPS_NSTATES) {
 300                 const char *states[] = PFUDPS_NAMES;
 301
 302                 printf("   %s:%s\n", states[src->state], states[dst->state]);
 303 #ifndef INET6
 304         } else if (proto != IPPROTO_ICMP && src->state < PFOTHERS_NSTATES &&
 305             dst->state < PFOTHERS_NSTATES) {
 306 #else
 307         } else if (proto != IPPROTO_ICMP && proto != IPPROTO_ICMPV6 &&
 308             src->state < PFOTHERS_NSTATES && dst->state < PFOTHERS_NSTATES) {
 309 #endif
 310                 /* XXX ICMP doesn't really have state levels */
 311                 const char *states[] = PFOTHERS_NAMES;
 312
 313                 printf("   %s:%s\n", states[src->state], states[dst->state]);
 314         } else {
 315                 printf("   %u:%u\n", src->state, dst->state);
 316         }
 317
 318         if (opts & PF_OPT_VERBOSE) {
 319                 u_int32_t creation = s->creation;
 320                 u_int32_t expire = s->expire;
 321
 322                 sec = creation % 60;
 323                 creation /= 60;
 324                 min = creation % 60;
 325                 creation /= 60;
 326                 printf("   age %.2u:%.2u:%.2u", creation, min, sec);
 327                 sec = expire % 60;
 328                 expire /= 60;
 329                 min = expire % 60;
 330                 expire /= 60;
 331                 printf(", expires in %.2u:%.2u:%.2u", expire, min, sec);
 332
 333                 printf(", %ju:%ju pkts, %ju:%ju bytes",
 334                     s->packets[0],
 335                     s->packets[1],
 336                     s->bytes[0],
 337                     s->bytes[1]);
 338                 if (s->anchor != -1)
 339                         printf(", anchor %u", s->anchor);
 340                 if (s->rule != -1)
 341                         printf(", rule %u", s->rule);
 342                 if (s->state_flags & PFSTATE_SLOPPY)
 343                         printf(", sloppy");
 344                 if (s->sync_flags & PFSYNC_FLAG_SRCNODE)
 345                         printf(", source-track");
 346                 if (s->sync_flags & PFSYNC_FLAG_NATSRCNODE)
 347                         printf(", sticky-address");
 348                 printf("\n");
 349         }
 350         if (opts & PF_OPT_VERBOSE2) {
 351                 u_int64_t id;
 352
 353                 bcopy(&s->id, &id, sizeof(u_int64_t));
 354                 printf("   id: %016jx creatorid: %08x", id, s->creatorid);
 355                 printf(" gateway: ");
 356                 print_host(&s->rt_addr, 0, af, opts);
 357                 printf("\n");
 358
 359                 if (strcmp(s->ifname, s->orig_ifname) != 0)
 360                         printf("   origif: %s\n", s->orig_ifname);
 361         }
 362 }
 363
 364 int
 365 unmask(struct pf_addr *m, sa_family_t af)
 366 {
 367         int i = 31, j = 0, b = 0;
 368         u_int32_t tmp;
 369
 370         while (j < 4 && m->addr32[j] == 0xffffffff) {
 371                 b += 32;
 372                 j++;
 373         }
 374         if (j < 4) {
 375                 tmp = ntohl(m->addr32[j]);
 376                 for (i = 31; tmp & (1 << i); --i)
 377                         b++;
 378         }
 379         return (b);
 380 }